CVE-2024-35803: linux-libc-dev - Call mixed mode boot services on the firmware's stack
Summary
CVE-2024-35803: In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Call mixed mode boot services on the firmware's stack Normally, the EFI stub calls into the EFI boot services using the stack that was live... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library development files for the Linux kernel. It is an essential component for building and compiling applications on Debian-based systems. The vulnerability identified as CVE-2024-35803 affects the linux-libc-dev package, potentially exposing systems to security risks.
Vulnerability Detail
The vulnerability in linux-libc-dev arises from the way the EFI stub calls into the EFI boot services using the stack that was live when the stub was entered. In mixed mode, where the bootloader calls the 32-bit EFI stub entry point, the boot stack is set up using a fixed allocation of 16k. This stack is still in use when the EFI stub is started in 64-bit mode, leading to all calls back into the EFI firmware using the limited boot stack. An attacker could exploit this vulnerability to corrupt the end of the .data section, potentially leading to unauthorized access or system instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have the latest security updates installed and following best practices for system security.
Conclusion
The vulnerability in linux-libc-dev (CVE-2024-35803) exposes systems to potential security risks. It is crucial to update the linux-libc-dev package to the latest version to mitigate these risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library development files for the Linux kernel. It is used for building and compiling applications on Debian-based systems.
This vulnerability could potentially allow an attacker to corrupt the end of the .data section, leading to unauthorized access or system instability.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later. This can be done by running the package manager update command specific to your operating system.
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have the latest security updates installed and following best practices for system security.
More information about this vulnerability can be found on the Debian Security Tracker website.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
